Threats tagged 'ghsa-m9xj-cppc-fm6c'

QuickJS-NG versions before 0.16.0 have an integer overflow vulnerability in the js_proxy_get_own_property_names() function within quickjs.c. This flaw can lead to a heap buffer overflow on 32-bit systems when JavaScript code returns a large array-like object from a Proxy ownKeys trap. The vulnerability may cause application crashes or potentially allow code execution.